mmctl terminal escape injection via unsanitized server-controlled output (CVE-2026-3108)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledserver/cmd/mmctl/commands/report.go:111

   reportPostsCmdF

2. 1
   Step 01server/cmd/mmctl/commands/report.go:111-118

   The administrator runs mmctl report posts, which fetches post objects from the Mattermost API and passes every returned post into printReportPost. The post.Message field is user-controlled content stored on the server.

   response, _, err := c.GetPostsForReporting(context.TODO(), options, cursorObj)
   if err != nil {
       return fmt.Errorf("failed to get posts for reporting: %w", err)
   }
   
   for _, post := range response.Posts {
       printReportPost(post)
   }
   

3. 2
   Step 02server/cmd/mmctl/commands/report.go:147-152

   Before the fix, report output wrote post.Message directly to stdout. The patched code applies printer.SanitizeForTerminal before rendering the message.

   fmt.Fprintf(os.Stdout, "Post ID: %s\n", post.Id)
   fmt.Fprintf(os.Stdout, "User ID: %s\n", post.UserId)
   fmt.Fprintf(os.Stdout, "Channel ID: %s\n", post.ChannelId)
   fmt.Fprintf(os.Stdout, "Message: %s\n", printer.SanitizeForTerminal(post.Message))
   

4. 3
   Step 03server/cmd/mmctl/printer/printer.go:103-115

   Most mmctl commands render API-derived values through templates and append the rendered string into printer.Lines.

   tpl := template.Must(template.New("").Funcs(printer.templateFuncs).Parse(templateString))
   sb := &strings.Builder{}
   if err := tpl.Execute(sb, v); err != nil {
       PrintError("Can't print the message using the provided template: " + templateString)
       return
   }
   printer.Lines = append(printer.Lines, sb.String())
   

5. 4
   Step 04server/cmd/mmctl/printer/printer.go:272-280

   The central plain-text sink now converts each line to a string and strips terminal control sequences before writing to the output buffer.

   case FormatPlain:
       var buf bytes.Buffer
       for i := range p.Lines {
           line := fmt.Sprintf("%s", p.Lines[i])
           fmt.Fprintf(&buf, "%s%s", SanitizeForTerminal(line), newline)
       }
       b = buf.Bytes()
   

6. 5
   Step 05server/cmd/mmctl/printer/printer_helpers.go:27-61

   SanitizeForTerminal removes ANSI CSI, OSC, DCS, APC/PM, single-character escape sequences, and remaining control characters except tab, newline, and carriage return.

   func SanitizeForTerminal(s string) string {
       result := csiRegex.ReplaceAllString(s, "")
       result = oscRegex.ReplaceAllString(result, "")
       result = dcsRegex.ReplaceAllString(result, "")
       result = otherEscRegex.ReplaceAllString(result, "")
   
       var cleaned strings.Builder
       cleaned.Grow(len(result))
       for _, r := range result {
           switch {
           case r == '\t' || r == '\n' || r == '\r':
               cleaned.WriteRune(r)
           case r < 0x20 || r == 0x7F:
               continue
           default:
               cleaned.WriteRune(r)
           }
       }
       return cleaned.String()
   }
   

7. Sinkserver/cmd/mmctl/printer/printer.go:275

   Printer.linesToBytes